@nylorun/runtime 0.10.0-beta → 0.12.0-beta

package/dist/tenant/migration.js

@@ -1,116 +0,0 @@
-import { copyFileSync, existsSync, mkdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
-import { join } from "node:path";
-import { DatabaseSync } from "node:sqlite";
-import { TENANT_SCHEMA_VERSION, migrateTenantDatabase as defaultMigrate, schemaVersionOf as defaultSchemaVersionOf, } from "./schema.js";
-import { writeEnvelopeFile } from "./envelope.js";
-import { quarantine } from "./quarantine.js";
-function stamp(now) {
-    return now.toISOString().replaceAll(":", "-");
-}
-function copyIfPresent(from, to) {
-    if (existsSync(from))
-        copyFileSync(from, to);
-}
-/**
- * Checkpoint WAL, snapshot database + envelope + KEK, migrate, update envelope.
- * On failure restore the snapshot, keep diagnostics, and throw migration-failed.
- */
-export function migrateTenantWithSnapshot(paths, envelope, hooks = {}, now = new Date()) {
-    const schemaVersionOf = hooks.schemaVersionOf ?? defaultSchemaVersionOf;
-    const migrateTenantDatabase = hooks.migrateTenantDatabase ?? defaultMigrate;
-    const target = hooks.targetVersion ?? TENANT_SCHEMA_VERSION;
-    const db = new DatabaseSync(paths.database);
-    let from;
-    try {
-        from = schemaVersionOf(db);
-    }
-    catch (error) {
-        db.close();
-        throw error;
-    }
-    if (from > target) {
-        db.close();
-        throw quarantine("schema-too-new", `Tenant schema version ${from} is newer than Host ${target}`, { tenantId: envelope.id });
-    }
-    if (from === target) {
-        db.close();
-        return envelope;
-    }
-    const dirName = `${from}-${target}-${stamp(now)}`;
-    mkdirSync(paths.migration, { recursive: true });
-    const snapshotDir = join(paths.migration, dirName);
-    mkdirSync(snapshotDir, { recursive: true });
-    try {
-        // Checkpoint WAL so the database file is self-contained (invariant 7).
-        db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
-        db.close();
-        copyIfPresent(paths.database, join(snapshotDir, "tenant.sqlite"));
-        copyIfPresent(paths.envelope, join(snapshotDir, "tenant.json"));
-        copyIfPresent(paths.kek, join(snapshotDir, "vault-kek"));
-        // Side-car WAL/SHM if present.
-        copyIfPresent(`${paths.database}-wal`, join(snapshotDir, "tenant.sqlite-wal"));
-        copyIfPresent(`${paths.database}-shm`, join(snapshotDir, "tenant.sqlite-shm"));
-        const migrating = new DatabaseSync(paths.database);
-        let result;
-        try {
-            migrating.exec("BEGIN IMMEDIATE");
-            result = migrateTenantDatabase(migrating);
-            migrating.exec("COMMIT");
-        }
-        catch (error) {
-            try {
-                migrating.exec("ROLLBACK");
-            }
-            catch {
-                /* ignore */
-            }
-            migrating.close();
-            throw error;
-        }
-        migrating.close();
-        const updated = {
-            ...envelope,
-            schemaVersion: result.to,
-            updatedAt: now.toISOString(),
-        };
-        writeEnvelopeFile(paths.envelope, updated);
-        return updated;
-    }
-    catch (error) {
-        restoreSnapshot(paths, snapshotDir);
-        writeFileSync(join(snapshotDir, "failure.json"), `${JSON.stringify({
-            at: now.toISOString(),
-            message: error instanceof Error ? error.message : String(error),
-        }, null, 2)}\n`);
-        throw quarantine("migration-failed", error instanceof Error ? error.message : "migration failed", { tenantId: envelope.id, migrationPath: snapshotDir });
-    }
-}
-function restoreSnapshot(paths, snapshotDir) {
-    const dbSnap = join(snapshotDir, "tenant.sqlite");
-    const envSnap = join(snapshotDir, "tenant.json");
-    const kekSnap = join(snapshotDir, "vault-kek");
-    if (existsSync(dbSnap)) {
-        // Replace via temp rename so a partial copy cannot leave a half file.
-        const tmp = `${paths.database}.restore-tmp`;
-        copyFileSync(dbSnap, tmp);
-        renameSync(tmp, paths.database);
-    }
-    if (existsSync(envSnap)) {
-        const tmp = `${paths.envelope}.restore-tmp`;
-        copyFileSync(envSnap, tmp);
-        renameSync(tmp, paths.envelope);
-    }
-    if (existsSync(kekSnap)) {
-        const tmp = `${paths.kek}.restore-tmp`;
-        copyFileSync(kekSnap, tmp);
-        renameSync(tmp, paths.kek);
-    }
-    for (const side of ["-wal", "-shm"]) {
-        const snap = join(snapshotDir, `tenant.sqlite${side}`);
-        const dest = `${paths.database}${side}`;
-        if (existsSync(snap))
-            copyFileSync(snap, dest);
-        else if (existsSync(dest))
-            rmSync(dest, { force: true });
-    }
-}

package/dist/tenant/schema.d.ts

@@ -1,23 +0,0 @@
-import type { DatabaseSync } from "node:sqlite";
-/** Tenant schema version (D4). v2 adds tenant_settings; v3 adds workflow links. */
-export declare const TENANT_SCHEMA_VERSION = 3;
-export declare function schemaVersionOf(db: DatabaseSync): number;
-/**
- * Migrates a Tenant database to `TENANT_SCHEMA_VERSION`.
- * Carries vault-scope DDL as a migration step, not ad hoc (D3, D4).
- */
-export declare function migrateTenantDatabase(db: DatabaseSync): {
-    from: number;
-    to: number;
-};
-export type SandboxBackendSetting = "auto" | "microsandbox" | "virtual";
-/** Non-secret Tenant settings persisted for seed / configFor (A18). */
-export declare function readTenantSetting(db: DatabaseSync, key: string): string | undefined;
-export declare function writeTenantSetting(db: DatabaseSync, key: string, value: string): void;
-/**
- * Read non-secret Tenant configuration from the open database.
- * Used by Host `configFor` at Integration I1.
- */
-export declare function readTenantConfig(db: DatabaseSync): {
-    sandboxBackend?: SandboxBackendSetting;
-};

package/dist/tenant/schema.js

@@ -1,151 +0,0 @@
-/** Tenant schema version (D4). v2 adds tenant_settings; v3 adds workflow links. */
-export const TENANT_SCHEMA_VERSION = 3;
-export function schemaVersionOf(db) {
-    const row = db.prepare("PRAGMA user_version").get();
-    return Number(row.user_version);
-}
-/**
- * Migrates a Tenant database to `TENANT_SCHEMA_VERSION`.
- * Carries vault-scope DDL as a migration step, not ad hoc (D3, D4).
- */
-export function migrateTenantDatabase(db) {
-    const from = schemaVersionOf(db);
-    if (from > TENANT_SCHEMA_VERSION) {
-        throw new Error(`Tenant schema version ${from} is newer than Host ${TENANT_SCHEMA_VERSION}`);
-    }
-    if (from === TENANT_SCHEMA_VERSION) {
-        return { from, to: from };
-    }
-    db.exec("BEGIN IMMEDIATE");
-    try {
-        if (from < 1) {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS definitions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-        CREATE TABLE IF NOT EXISTS sessions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-        CREATE TABLE IF NOT EXISTS commands(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-        CREATE TABLE IF NOT EXISTS checkpoints(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-        CREATE TABLE IF NOT EXISTS effects(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-        CREATE TABLE IF NOT EXISTS actions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-        CREATE TABLE IF NOT EXISTS sandboxes(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-        CREATE TABLE IF NOT EXISTS events(
-          sequence INTEGER PRIMARY KEY AUTOINCREMENT,
-          session_id TEXT NOT NULL,
-          body TEXT NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS events_session ON events(session_id, sequence);
-        CREATE TABLE IF NOT EXISTS vaults(
-          id TEXT PRIMARY KEY,
-          name TEXT NOT NULL,
-          owner_user_id TEXT NOT NULL,
-          metadata_json TEXT,
-          created_at TEXT NOT NULL,
-          scope TEXT NOT NULL DEFAULT 'user'
-        );
-        CREATE INDEX IF NOT EXISTS vaults_owner ON vaults(owner_user_id);
-        CREATE TABLE IF NOT EXISTS vault_credentials(
-          id TEXT PRIMARY KEY,
-          vault_id TEXT NOT NULL REFERENCES vaults(id) ON DELETE CASCADE,
-          name TEXT NOT NULL,
-          type TEXT NOT NULL,
-          binding_json TEXT NOT NULL,
-          expires_at TEXT,
-          created_at TEXT NOT NULL,
-          rotated_at TEXT,
-          kek_id TEXT NOT NULL,
-          nonce BLOB NOT NULL,
-          ciphertext BLOB NOT NULL,
-          wrapped_dek BLOB NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS vault_credentials_vault ON vault_credentials(vault_id);
-        CREATE TABLE IF NOT EXISTS vault_audit(
-          id TEXT PRIMARY KEY,
-          at TEXT NOT NULL,
-          actor TEXT NOT NULL,
-          action TEXT NOT NULL,
-          vault_id TEXT,
-          credential_id TEXT,
-          session_id TEXT,
-          target TEXT,
-          outcome TEXT NOT NULL
-        );
-        CREATE TABLE IF NOT EXISTS vault_idempotency(
-          id TEXT PRIMARY KEY,
-          body_hash TEXT NOT NULL,
-          response TEXT NOT NULL
-        );
-        CREATE TABLE IF NOT EXISTS executors(
-          agent_id TEXT PRIMARY KEY,
-          token_hash TEXT NOT NULL UNIQUE,
-          implementation_version TEXT NOT NULL,
-          manifest_hash TEXT,
-          principal_id TEXT,
-          created_at TEXT NOT NULL,
-          updated_at TEXT NOT NULL
-        );
-        CREATE TABLE IF NOT EXISTS principals(
-          id TEXT PRIMARY KEY,
-          role TEXT NOT NULL CHECK(role = 'application'),
-          token_hash TEXT NOT NULL UNIQUE,
-          idempotency_key TEXT,
-          created_at TEXT NOT NULL
-        );
-      `);
-            migrateVaultScope(db);
-            ensureExecutorPrincipalColumn(db);
-        }
-        if (from < 2) {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS tenant_settings(
-          key TEXT PRIMARY KEY,
-          value TEXT NOT NULL
-        );
-      `);
-        }
-        if (from < 3) {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS links(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-      `);
-        }
-        db.exec(`PRAGMA user_version = ${TENANT_SCHEMA_VERSION}`);
-        db.exec("COMMIT");
-    }
-    catch (error) {
-        db.exec("ROLLBACK");
-        throw error;
-    }
-    return { from, to: TENANT_SCHEMA_VERSION };
-}
-/** Existing vault-scope step, now owned by the Tenant migration. */
-function migrateVaultScope(db) {
-    const columns = db.prepare("PRAGMA table_info(vaults)").all();
-    if (!columns.some((column) => column.name === "scope"))
-        db.exec("ALTER TABLE vaults ADD COLUMN scope TEXT NOT NULL DEFAULT 'user'");
-    db.exec("CREATE UNIQUE INDEX IF NOT EXISTS vaults_one_host ON vaults(scope) WHERE scope = 'host'");
-}
-/** Additive column for registration credential attribution (A6). */
-function ensureExecutorPrincipalColumn(db) {
-    const columns = db.prepare("PRAGMA table_info(executors)").all();
-    if (!columns.some((column) => column.name === "principal_id"))
-        db.exec("ALTER TABLE executors ADD COLUMN principal_id TEXT");
-}
-/** Non-secret Tenant settings persisted for seed / configFor (A18). */
-export function readTenantSetting(db, key) {
-    const row = db
-        .prepare("SELECT value FROM tenant_settings WHERE key=?")
-        .get(key);
-    return row ? String(row.value) : undefined;
-}
-export function writeTenantSetting(db, key, value) {
-    db.prepare(`INSERT INTO tenant_settings(key,value) VALUES(?,?)
-     ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run(key, value);
-}
-/**
- * Read non-secret Tenant configuration from the open database.
- * Used by Host `configFor` at Integration I1.
- */
-export function readTenantConfig(db) {
-    const raw = readTenantSetting(db, "sandbox.backend");
-    if (raw === "auto" || raw === "microsandbox" || raw === "virtual")
-        return { sandboxBackend: raw };
-    return {};
-}

package/dist/tenant/store-fs.d.ts

@@ -1,16 +0,0 @@
-import { DatabaseSync } from "node:sqlite";
-import type { BootstrapPrincipal, Logger, OpenTenantRuntime, TenantConfig, TenantStore } from "./types.js";
-import type { MigrationHooks } from "./migration.js";
-export interface FsTenantStoreOptions {
-    hostRoot: string;
-    openRuntime: OpenTenantRuntime;
-    configFor: (tenantId: string) => TenantConfig;
-    logger?: Logger;
-    migration?: MigrationHooks;
-    /** Writes the application principal into a fresh Tenant database. */
-    writeBootstrap?: (db: DatabaseSync, bootstrap: BootstrapPrincipal, now: Date) => void;
-}
-export declare function createFsTenantStore(options: FsTenantStoreOptions): TenantStore;
-/** Claim the Tenant lock file (used by fake openRuntime in tests). */
-export declare function claimTenantLock(lockPath: string, pid?: number): void;
-export declare function releaseTenantLock(lockPath: string): void;

package/dist/tenant/store-fs.js

@@ -1,205 +0,0 @@
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
-import { join } from "node:path";
-import { DatabaseSync } from "node:sqlite";
-import { isTenantId } from "@nylorun/core/compatibility";
-import { hostPaths, tenantPaths } from "./paths.js";
-import { readEnvelopeFile, writeEnvelopeFile } from "./envelope.js";
-import { migrateTenantWithSnapshot } from "./migration.js";
-import { quarantine } from "./quarantine.js";
-import { bootstrapPrincipal } from "./principals.js";
-import { TENANT_SCHEMA_VERSION, migrateTenantDatabase as defaultMigrate, schemaVersionOf as defaultSchemaVersionOf, } from "./schema.js";
-function defaultWriteBootstrap(db, bootstrap, _now) {
-    defaultMigrate(db);
-    bootstrapPrincipal(db, bootstrap);
-}
-function assertLiveLock(lockPath, tenantId) {
-    if (!existsSync(lockPath))
-        return;
-    let raw;
-    try {
-        raw = readFileSync(lockPath, "utf8").trim();
-    }
-    catch {
-        throw quarantine("corrupt", "could not read .runtime-lock", { tenantId });
-    }
-    const lockPid = Number(raw);
-    if (!Number.isSafeInteger(lockPid) || lockPid < 1) {
-        throw quarantine("locked", "invalid .runtime-lock contents", {
-            tenantId,
-            lockPath,
-        });
-    }
-    try {
-        process.kill(lockPid, 0);
-    }
-    catch (error) {
-        const err = error;
-        if (err.code === "ESRCH") {
-            rmSync(lockPath, { force: true });
-            return;
-        }
-        // EPERM: process exists but we cannot signal it — treat as live owner.
-        if (err.code !== "EPERM")
-            throw error;
-    }
-    throw quarantine("locked", "another process holds this Tenant lock", {
-        tenantId,
-        lockPath,
-        lockPid,
-    });
-}
-function trashStamp(now) {
-    return now.toISOString().replaceAll(":", "-");
-}
-export function createFsTenantStore(options) {
-    const host = hostPaths(options.hostRoot);
-    mkdirSync(host.tenants, { recursive: true });
-    mkdirSync(host.trash, { recursive: true });
-    const writeBootstrap = options.writeBootstrap ?? defaultWriteBootstrap;
-    const migrationHooks = {
-        schemaVersionOf: options.migration?.schemaVersionOf ?? defaultSchemaVersionOf,
-        migrateTenantDatabase: options.migration?.migrateTenantDatabase ?? defaultMigrate,
-        targetVersion: options.migration?.targetVersion ?? TENANT_SCHEMA_VERSION,
-    };
-    return {
-        async enumerate() {
-            if (!existsSync(host.tenants))
-                return [];
-            return readdirSync(host.tenants, { withFileTypes: true })
-                .filter((d) => d.isDirectory() && isTenantId(d.name))
-                .map((d) => d.name);
-        },
-        async readEnvelope(id) {
-            const paths = tenantPaths(options.hostRoot, id);
-            return readEnvelopeFile(paths.envelope, id);
-        },
-        async create(envelope, bootstrap) {
-            const paths = tenantPaths(options.hostRoot, envelope.id);
-            if (existsSync(paths.root) || existsSync(paths.envelope)) {
-                return "exists";
-            }
-            const now = new Date();
-            try {
-                mkdirSync(paths.root, { recursive: true, mode: 0o700 });
-                for (const dir of [
-                    paths.home,
-                    paths.tmp,
-                    paths.sandboxes,
-                    paths.pluginData,
-                    paths.logs,
-                    paths.migration,
-                ]) {
-                    mkdirSync(dir, { recursive: true });
-                }
-                writeEnvelopeFile(paths.envelope, envelope);
-                const db = new DatabaseSync(paths.database);
-                try {
-                    writeBootstrap(db, bootstrap, now);
-                }
-                finally {
-                    db.close();
-                }
-                // Exclusive create marker for the lock file is owned by openRuntime (WS-A);
-                // we only ensure the parent exists.
-                return "created";
-            }
-            catch (error) {
-                rmSync(paths.root, { recursive: true, force: true });
-                throw error;
-            }
-        },
-        async bootstrapMatches(id, bootstrap) {
-            const paths = tenantPaths(options.hostRoot, id);
-            if (!existsSync(paths.database))
-                return false;
-            const db = new DatabaseSync(paths.database, { readOnly: true });
-            try {
-                const row = db
-                    .prepare(`SELECT id, token_hash, idempotency_key FROM principals
-             WHERE role = 'application' LIMIT 1`)
-                    .get();
-                if (!row)
-                    return false;
-                return (row.id === bootstrap.principalId &&
-                    row.token_hash === bootstrap.credentialHash &&
-                    row.idempotency_key === bootstrap.idempotencyKey);
-            }
-            catch {
-                return false;
-            }
-            finally {
-                db.close();
-            }
-        },
-        async open(id) {
-            const paths = tenantPaths(options.hostRoot, id);
-            if (!existsSync(paths.root)) {
-                throw quarantine("open-failed", `Tenant directory missing`, {
-                    tenantId: id,
-                });
-            }
-            assertLiveLock(paths.lock, id);
-            let envelope;
-            try {
-                envelope = readEnvelopeFile(paths.envelope, id);
-            }
-            catch (error) {
-                throw error;
-            }
-            if (!existsSync(paths.database)) {
-                throw quarantine("corrupt", "tenant.sqlite is missing", {
-                    tenantId: id,
-                });
-            }
-            // Probe schema before openRuntime so schema-too-new never mutates.
-            const probe = new DatabaseSync(paths.database);
-            let version;
-            try {
-                version = migrationHooks.schemaVersionOf(probe);
-            }
-            finally {
-                probe.close();
-            }
-            const target = migrationHooks.targetVersion ?? TENANT_SCHEMA_VERSION;
-            if (version > target) {
-                throw quarantine("schema-too-new", `Tenant schema version ${version} is newer than Host ${target}`, { tenantId: id });
-            }
-            if (version < target) {
-                envelope = migrateTenantWithSnapshot(paths, envelope, migrationHooks);
-            }
-            const config = options.configFor(id);
-            return options.openRuntime({
-                ...config,
-                tenantId: id,
-                paths: config.paths.root ? config.paths : paths,
-            });
-        },
-        async trash(id, now) {
-            const paths = tenantPaths(options.hostRoot, id);
-            if (!existsSync(paths.root))
-                return;
-            mkdirSync(host.trash, { recursive: true });
-            const dest = join(host.trash, `${id}-${trashStamp(now)}`);
-            renameSync(paths.root, dest);
-        },
-        async removePartial(id) {
-            const paths = tenantPaths(options.hostRoot, id);
-            if (existsSync(paths.root)) {
-                rmSync(paths.root, { recursive: true, force: true });
-            }
-        },
-    };
-}
-/** Claim the Tenant lock file (used by fake openRuntime in tests). */
-export function claimTenantLock(lockPath, pid = process.pid) {
-    const fd = openSync(lockPath, "wx");
-    try {
-        writeFileSync(fd, String(pid));
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-export function releaseTenantLock(lockPath) {
-    rmSync(lockPath, { force: true });
-}